Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects disabling of PowerShell command history logging to impair forensics
This rule detects the creation of an inbound firewall allow rule by `netsh` or `powershell` when the initiating process (actor) is launched from a user-writable location such as `temp`, `appdata`, `programdata`, or `users\public`. This behavior can indicate malicious activity where an adversary attempts to establish network access or persistence by modifying firewall settings from an unusual or untrusted execution path.
Detects PowerShell commands extracting and executing script blocks embedded in XML files (e.g., unattend.xml). This behavior is observed in the GreatXML BitLocker bypass exploit, where an attacker leverages a crafted unattend.xml during Windows Defender Offline Scan to spawn an unrestricted shell.
Detects PowerShell executing a one-liner Invoke-WebRequest to pull the TiFlux installer directly from an attacker-hosted repository or the vendor.
This rule detects PowerShell executing a payload deceptively named as a JPEG image file, specifically 'sysupdate.jpeg', followed by subsequent outbound network activity. This behavior is indicative of the SilentCanvas campaign.
Detects Microsoft Office applications (Word, Excel, PowerPoint) spawning command-line interpreters (PowerShell, CMD, WScript). This behavior is characteristic of malicious macros or exploitation attempts where Office applications execute shell commands to facilitate second-stage payload delivery or system compromise.
Detects instances where FFmpeg media processing tools spawn interactive shell processes. This behavior is highly indicative of successful remote code execution (RCE) via CVE-2026-8461 (PixelSmash), where an attacker hijacks the AVBuffer struct to call libc's system() function.
Detects the creation of a Python launcher file with a '.mod' extension in temporary or user library directories by common script hosts (node, python, wscript, cscript, powershell). This activity is indicative of the InvisibleFerret malware (also known as Void DoKkaebi or BeaverTail) which uses such launchers to import newly downloaded .pyd or .so extensions and supply runtime connection arguments.
Detects a backdoor querying adapter IP, processor ID, and device serial values in one sequence to derive a unique cloud folder identifier. This rule specifically looks for command-line executions of wmic, powershell, or cmd that contain strings related to Win32_NetworkAdapter, ProcessorId, SerialNumber, Win32_PhysicalMedia, or MACAddress.
Detects PowerShell executing the CreateInstallServiceWork function with a custom FulfillmentPluginId, which is indicative of the UnCanny coercion technique.
Detects PowerShell invoking Windows.Internal.InstallService.Control to create an install work item via the UNCanny coercion primitive. This COM-based API call triggers the Windows Store Install Service to process a work item from an attacker-controlled UNC path, resulting in NTLM machine account coercion or SYSTEM-level DLL execution.
Identifies the core ClickFix vector: explorer.exe (via the Windows Run prompt) executing pasted PowerShell commands containing IEX and Get-Clipboard to execute the first stage.
Detects Microsoft Teams spawning child processes (cmd, powershell, wscript, mshta, rundll32, regsvr32, certutil) after receiving external communications, a technique used by MuddyWater for initial access and execution.
Detects the specific process chain: wscript.exe -> powershell.exe -> MSBuild.exe, which is characteristic of the SHADOW#REACTOR malware campaign. This chain indicates the use of scripting interpreters (Wscript and PowerShell) to launch MSBuild for malicious purposes, often involving in-memory execution or compilation of malicious code.
This rule detects suspicious process creation events where common scripting or command-line interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe, regsvcs.exe) are spawned by Microsoft Office applications (winword.exe, excel.exe, powerpnt.exe, outlook.exe). This behavior is often indicative of malicious activity, such as macro-enabled malware attempting to execute payloads.
This rule detects instances where common command and scripting interpreters (powershell.exe, cmd.exe, cscript.exe) are launched by unusual parent processes. The rule specifically looks for these interpreters being spawned by processes other than explorer.exe, notepad.exe, mspaint.exe, or svchost.exe, and triggers if this occurs at least twice within an hour on the same computer by the same user.
This rule detects modifications to Windows Registry Run keys (Run, RunOnce, RunOnceEx, Policies\Run) where the new value contains common scripting interpreters like PowerShell, cmd, cscript, or wscript, and the path is not within the System32 directory. This behavior is indicative of an adversary attempting to establish persistence by ensuring their malicious script or command executes upon user login.
Detects suspicious command-line executions indicative of potential malicious activity, including the use of certutil for encoding/decoding, bitsadmin for transfers, and various PowerShell command invocations. This rule monitors process creation events (EventID 4688) for specific command-line patterns that are often abused by adversaries for tasks such as file transfer, execution, or obfuscation.
This rule detects command-line executions that involve downloading content from the internet and immediately executing it. It specifically looks for `SecurityEvent` with `EventID 4688` (process creation) where the `CommandLine` contains keywords associated with web client operations (`IEX(New-Object Net.WebClient)`, `DownloadString`, `DownloadFile`, `Invoke-WebRequest`, `curl.exe`) and also contains terms indicating a download and execute intent (`http`, `payload`, `execute`). This pattern is commonly used by adversaries for initial access, execution, and persistence.
This rule detects the execution of ScreenConnect client services or MSI installers when initiated by common scripting or installer processes such as wscript.exe, cscript.exe, powershell.exe, or msiexec.exe. This behavior can indicate the abuse of legitimate remote monitoring and management (RMM) tools for malicious purposes, such as initial access, persistence, or remote control by adversaries.
This rule detects the use of PowerShell to create or modify Quality of Service (QoS) policies, specifically looking for the 'New-NetQosPolicy' cmdlet combined with parameters related to bandwidth throttling ('ThrottleRateActionBitsPerSecond') or application targeting ('AppPathNameMatchCondition'). This activity can be indicative of an attacker attempting to disrupt EDR agent connectivity by severely limiting network bandwidth, a technique associated with 'EDRChoker'.
Page 129 of 213